Description
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Published: 2026-10-20
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure & Remote Data Exfiltration
Action: Apply Patch
AI Analysis

Impact

A third‑party diagnostic dump bundle can contain an XML file that instructs jdmpview or equivalent DTFJ code to read a local file named inside the bundle. The contents of that file are then transmitted to an arbitrary remote host. This local attacker control can therefore lead to unintended disclosure of local data and the exfiltration of that data over the network.

Affected Systems

Eclipse OpenJ9 up to version 0.63 is affected when the jdmpview tool is used to open a diagnostic dump bundle. The vulnerability appears in the XMLIndexReader component that parses the bundled XML, allowing manipulation of external entities.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity vulnerability. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user or analyst who opens a crafted diagnostic dump bundle. Once a bundle is processed, the tool will read the specified local file and send its contents to an external host, which can be leveraged to exfiltrate sensitive data.

Generated by OpenCVE AI on October 20, 2026 at 18:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Eclipse OpenJ9 to version 0.64 or later to remove the vulnerability.
  • If an immediate upgrade is not possible, reconfigure jdmpview (or the DTFJ code) to disable XML external entity processing, preventing external entities in the bundle from being resolved.
  • Run jdmpview under an account with the least privileges necessary and restrict its file‑system and network access to mitigate the impact if the vulnerability is exploited.

Generated by OpenCVE AI on October 20, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse eclipse Openj9
Vendors & Products Eclipse
Eclipse eclipse Openj9

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Title jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
Weaknesses CWE-611
CWE-618
References
Metrics cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Eclipse Openj9
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-10-20T15:39:43.964Z

Reserved: 2026-09-24T14:30:38.082Z

Link: CVE-2026-97400

cve-icon Vulnrichment

Updated: 2026-10-20T15:39:40.067Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T15:17:37.320

Modified: 2026-10-20T19:48:50.250

Link: CVE-2026-97400

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:30:59Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference

  • CWE-618

    Exposed Unsafe ActiveX Method